EUVD-2026-14156
GHSA-9mc9-jxch-8r4v
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Wikilookup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Popup Width' setting in all versions up to, and including, 1.1.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
The Wikilookup plugin for WordPress versions up to 1.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'Popup Width' setting due to insufficient input sanitization and output escaping. Authenticated attackers with Administrator-level access can inject arbitrary JavaScript that executes for all users viewing affected pages, but only in multi-site installations or where the unfiltered_html capability has been disabled. With a CVSS score of 4.4 and high attack complexity requirements, this represents a low-to-moderate real-world threat that requires both administrative access and specific WordPress configurations to exploit.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational cross-site scripting weakness. The Wikilookup plugin (CPE: cpe:2.3:a:mooeypoo:wikilookup:*:*:*:*:*:*:*:*) fails to properly sanitize user input in the 'Popup Width' setting before storing it in the WordPress database, and subsequently fails to escape output when rendering the setting in administrative pages. Code review of the vulnerable file (views/admin_wikilookup_display.php line 26) confirms the plugin directly echoes unsanitized settings without applying WordPress escaping functions such as wp_kses_post() or esc_attr(). The vulnerability specifically manifests in stored XSS context, meaning malicious payloads persist in the database and execute upon subsequent page loads, unlike reflected XSS which requires user interaction with a crafted URL.
RemediationAI
Upgrade the Wikilookup plugin to a patched version after version 1.1.5 has been released by the maintainer (mooeypoo). Users should navigate to WordPress Dashboard > Plugins > Installed Plugins, locate Wikilookup, and apply the available update when released. Until a patch is available, administrators can implement temporary mitigations: (1) restrict Administrator role access via role-based access control plugins, limiting who can modify Popup Width settings; (2) in single-site installations, enable the unfiltered_html capability to prevent the XSS from executing (though this has its own security implications); (3) regularly audit the Wikilookup settings in the WordPress database to detect any suspicious script injections. For multi-site installations where patching is delayed, consider temporarily deactivating the Wikilookup plugin until updates are available. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7526228-4e21-430c-90ad-1476c81698ad?source=cve for vendor guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today